Threat IntelligenceOct 14, 2026

Global takedown hits network behind 1 billion phishing messages

Global takedown disrupts cybercrime network behind 1 billion phishing messages.

Vendor Watch

Run Microsoft?

Get an email when a reviewed story names Microsoft, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works Privacy

Summary

Law enforcement and partners worldwide have disrupted a large cybercriminal ecosystem responsible for over a billion phishing messages targeting 75,000 organizations. The operation, initiated by Microsoft and Japan's NPA, identified the YAM Store marketplace and linked it to phishing kits like CoGUI, Haozi, and Iron Man System. These kits facilitated credential theft and fraud by impersonating legitimate organizations and using compromised accounts and AI-generated content.

The lesson from this incident

Full lesson

The YAM Store marketplace enabled cybercriminals to purchase ready-made phishing kits, dramatically lowering the barrier to entry for large-scale credential theft campaigns. By impersonating trusted organizations and leveraging AI-generated content, attackers bypassed traditional email filters and deceived users across 75,000 organizations worldwide. The use of compromised accounts to distribute phishing messages compounded the damage, as malicious emails originated from legitimately trusted senders. This case illustrates that phishing-as-a-service ecosystems can industrialize fraud to a scale that overwhelms reactive defenses, making proactive user education and technical controls essential.

What helps against this

How we list vendors

Google affected Microsoft research, affected

Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
For exampleCisco Duo Microsoft Entra ID Yubico YubiKey all options
Email authentication (DMARC)
Nobody can send email that pretends to come from your domain.
For exampledmarcian Valimail Enforce Red Sift OnDMARC all options
Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
For exampleCheck Point Harmony Email & Collaboration Abnormal AI Abnormal Inbound Email Security Proofpoint Core Email Protection all options

Indicators of Compromise

malware — CoGUI
malware — Haozi
malware — Iron Man System
malware — Storm-3119
malware — Storm-2990

Entities

Microsoft (vendor)Storm-3119 (threat_actor)Storm-2990 (threat_actor)Microsoft 365 (product)